Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stripe And A/B Testing Made Me A Small Fortune

kalzumeus.com

Post reply on HN
Print view View original

41–50 of 164 posts

Re: Stripe And A/B Testing Made Me A Small Fortune

#41

Post by saikat »

TomGullen wrote: post #7

> This means that their credit card details never hit your server. One thing I've been seeing recently is that some implementations using Stripe DO have the CC details hitting their server. The most common case being when Javascript is disabled the form posts to the website because the developer didn't design with graceful degradation, a dangerous mistake when mixed with credit card numbers. It doesn't appear to be a…

Yeah you are right here that it is still possible for our users to mess things up. We do things to try to keep merchants from accidentally sending card numbers to their server (e.g. the default example form makes this hard to do, and most people simply copy and paste this form). It's an explicit decision we've made, though, to leave control in our users' hands as many people seem to like the flexibility to have their checkout experience stay on their site and be designed by them. But we think about where to draw the lines here a decent amount.

Re: Stripe And A/B Testing Made Me A Small Fortune

#42

Post by MBCook »

saikat wrote: post #33
MBCook wrote: post #30

Earlier quoted context omitted.

I worked on something with credit card processing a few years ago. As I remember, it doesn't really matter if the details hit your server, but the point is you absolutely can not save them. No putting them in a DB, no putting the in a log file (not even the last four or something like that), nothing. So if your form takes the numbers in, you make an API call, and then you blank them in memory you were OK. If you put…

To make sure there isn't confusion here, having card details go through your server, even if you aren't saving them, still can lead to certain PCI compliance burdens (e.g. you may need to get an audit from a PCI auditor verifying this). Having the card never go to your server is the best way to make sure you are PCI compliant, as you mention.

Ah, thanks. Like I said, I wasn't sure. We made sure we were PCI compliant, but I wasn't in charge of that by any means.

Re: Stripe And A/B Testing Made Me A Small Fortune

#43

Post by sulife »

MBCook wrote: post #36
sulife wrote: post #5

Or spend a few hours, get a merchant account through a bank and authorize.net with much lower fees and a pretty standard API. Tons of classes to use authorize.net with and super simple... no point of adding ANOTHER layer... charging with a merchant account is trivial.

That's what a company I worked with did, and I thought it was a bad decision. The per-transaction fees are lower, but there is a monthly (or yearly) cost. The API is big because it covers so many cases that you probably won't use. Plus there are fees. Sure, they'll let you do e-checks (every customer wants those, right?), but that's a fee. Return? That's a fee. Chargeback? Fee. Process transactions in real-time inste…

You can negotiate all those BS fees to $0. For example.. I pay 0.1% + interchange. $0.05 per transaction gateway fee and $0.10 cc trans fee (includes AVS). $5/mo base fee. NOTHING ELSE (well chargeback fees, everywhere has that).

You have no clue what you're talking about. I guarantee Stripe will charge you CB fees too.

Only way Stripe is worth the time and % they jack it up is if you do LOW volume.

edit: 5 seconds in google and Stripe charges $15 for a chargeback, same as Chase. Basically paying Stripe 1% + another $0.15 or so per transaction. NO THANKS! No one doing any type of CC volume would be dumb enough to give that $ away.

Re: Stripe And A/B Testing Made Me A Small Fortune

#45

Post by Irishsteve »

saikat wrote: post #32
Irishsteve wrote: post #24

Stripe is a great service, but I get the feeling their PR company or marketing department promotes extensively here (Makes sense since its the target audience).

For what it's worth, we don't have a PR company or marketing department currently =). We try not to post on HN unless we actually think people on HN will like the content (and we've argued internally before and decided not to post stuff to HN because it didn't seem useful enough).

Eh, I wasn't meant to be so cynical (It just came across that way because I suppose I am!)

Re: Stripe And A/B Testing Made Me A Small Fortune

#46

Post by brador »

patio11 wrote: post #23
MarkMc wrote: post #20

In case anyone is curious, here's Patrick's sales graph: http://www.bingocardcreator.com/stats/sales-by-month You can see the big jump in May-July (although the jump for July is 32%, not 53%)

Oopsie. Thanks for the correction.

Patrick, just noticed your Adwords spend went from $1000's to $0 suddenly. Looks like a disaster. What happened? Is Adwords no longer viable?

Re: Stripe And A/B Testing Made Me A Small Fortune

#47

Post by vampirechicken »

lrem wrote: post #9

Just curious: are there any good options outside the US?

2checkout is an option for payments outside the US. They are a bit pricey, but they're one of the few international payment processors around, and have very good customer support, both for buyers and sellers.

[I used to work for 2co. I don't any more.]

Re: Stripe And A/B Testing Made Me A Small Fortune

#48

Post by saikat »

sulife wrote: post #5

Or spend a few hours, get a merchant account through a bank and authorize.net with much lower fees and a pretty standard API. Tons of classes to use authorize.net with and super simple... no point of adding ANOTHER layer... charging with a merchant account is trivial.

It may be worth noting (though you perhaps already know this) that our fees are all-inclusive. We don't charge extra for amex cards, international cards, qualified vs. non-qualified transactions, etc. These things often add up to make other gateways' fees higher than they seem.

Also, we have volume discounts for people processing more than a million dollars a year, so this may be something you'd be interested in.

Re: Stripe And A/B Testing Made Me A Small Fortune

#49

Post by vampirechicken »

saikat wrote: post #33
MBCook wrote: post #30

Earlier quoted context omitted.

I worked on something with credit card processing a few years ago. As I remember, it doesn't really matter if the details hit your server, but the point is you absolutely can not save them. No putting them in a DB, no putting the in a log file (not even the last four or something like that), nothing. So if your form takes the numbers in, you make an API call, and then you blank them in memory you were OK. If you put…

To make sure there isn't confusion here, having card details go through your server, even if you aren't saving them, still can lead to certain PCI compliance burdens (e.g. you may need to get an audit from a PCI auditor verifying this). Having the card never go to your server is the best way to make sure you are PCI compliant, as you mention.

One component is the transit security -is the data safe from interception in transit (on the network). The other component it security of the data at rest - is the data safe from interception if it comes to rest on your server (sessions, databases, etc.).

From data security standpoint is is easier to let somebody else do it, but end users tend to have a less satisfying checkout experience.

Re: Stripe And A/B Testing Made Me A Small Fortune

#50

Post by patio11 »

maximilianburke wrote: post #44

Patrick, I'm curious how you have been using Stripe as you are in Japan and it seems they only recently began expanding out of America. Is the business entity behind BCC registered in the US?

I signed up with my US address and banking information. "By registering for a Stripe Service Account, you are confirming to be either a legal resident of the United States, a United States citizen or a business entity authorized to conduct business by the state in which it operates." (Though I finally got a DBA from Illinois, um, yesterday. Not related to Stripe -- a hospital wasn't thrilled with the notion of writing a particular flavor of check to a natural person.)
Post reply on HN